← Back

CVE-2019-14930

nvd nist
Published: Oct 28, 2019Modified: Nov 21, 2024

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Undocumented hard-coded user passwords for root, ineaadmin, mitsadmin, and maint could allow an attacker to gain unauthorised access to the RTU. (Also, the accounts ineaadmin and mitsadmin are able to escalate privileges to root without supplying a password due to insecure entries in /etc/sudoers on the RTU.)

Affected (2)

Mitsubishielectric
1 product
Smartrtu Firmware
Inea
1 product
Me Rtu Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Smartrtu Firmware
Up to 2.02
Running on/withPlatform Versions
Mitsubishielectric
Smartrtu
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Me Rtu Firmware
Up to 3.0
Running on/withPlatform Versions
Inea
Me Rtu
All versions

Related CWEs

CWE-798
Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.

References (4)

Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory

Timeline

No history available yet.